filesystems - 在 NTFS 中读取 MFT

Question

在网上寻找有关如何读/写 MFT 的解释时，我发现了以下部分:( http://www.installsetupconfig.com/win32programming/1996%20AppE_apnilife.pdf )

If NtfsProtectSystemFiles is set to FALSE, then the special files can be opened. There are, however, some drawbacks associated with attempting to do this: Because many of the special files are opened in a special way when mounting the volume, they are not prepared to handle the IRP_MJ_READ requests resulting from a call to ZwReadFile, and the system crashes if such a request is received. These special files can be read by mapping the special file with ZwCreateSection and ZwMapViewOfSection and then reading the mapped data. A further problem is that a few of the special files are not prepared to handle the IRP_MJ_CLEANUP request that is generated when the last handle to a file object is closed, and the system crashes if such a request is received. The only option is to duplicate the open handle to the special file into a process that never terminates (such as the system process).

1. “他们不准备处理 IRP_MJ_READ 请求”是什么意思？需要什么样的准备？什么是 IRP_MJ_READ？
2. “用 ZwCreateSection 和 ZwMapViewOfSection 映射特殊文件，然后读取映射数据”如何解决问题？
3. “文件未准备好处理在文件对象的最后一个句柄关闭时生成的 IRP_MJ_CLEANUP 请求”是什么意思，又是什么准备？什么是 IRP_MJ_CLEANUP？
4. “将特殊文件的打开句柄复制到永不终止的进程中”如何解决问题？

Answer 1

那是旧数据(从 1996 年开始)。而且有点不正确。从那时起，世界一直在进步。

您可以尝试打开\$MFT 来读取 MFT，但正确获取访问位可能会有问题。您也可以编写它们，但这确实是在玩火。文件系统不希望在没有它参与的情况下修改它的数据结构。

最好打开原始分区并直接遍历磁盘结构。